type, title, status, and detail field — making automated error handling straightforward for both human developers and AI agents.
type field is always "about:blank" in the current API version. Future versions may introduce specific problem type URIs.Status Code Reference
| Code | Name | Common Cause |
|---|---|---|
200 | OK | Successful GET or POST with result |
201 | Created | Resource successfully created (e.g., API key, webhook) |
204 | No Content | Successful DELETE — no body returned |
400 | Bad Request | Missing required field or malformed JSON |
401 | Unauthorized | Missing or invalid X-API-Key |
402 | Payment Required | x402 — no payment header sent, or insufficient amount |
403 | Forbidden | Key exists but lacks permission for this endpoint or tier |
404 | Not Found | Entity, webhook, or resource ID does not exist |
409 | Conflict | Duplicate resource (e.g., webhook URL already registered) |
422 | Unprocessable Entity | Request parsed but field values are invalid |
429 | Too Many Requests | Rate limit or monthly quota exceeded |
500 | Internal Server Error | Unexpected server error — safe to retry |
503 | Service Unavailable | Planned maintenance or cascading dependency failure |
Error Response Format
Standard Error
All non-2xx responses return RFC 7807 problem details:Validation Error (422)
Field-level validation errors return adetail array instead of a string. Field names are sanitized — internal paths are not exposed:
400 Bad Request
Missing required field
Missing required field
/v1/entity/check, both entity_name and country are required. Verify you are sending Content-Type: application/json and a valid JSON body.Malformed JSON body
Malformed JSON body
json.dumps() in Python or JSON.stringify() in JavaScript rather than constructing JSON strings manually.Unsupported Content-Type
Unsupported Content-Type
Content-Type header is missing or set to a value other than application/json on a POST endpoint.Fix: Always include -H "Content-Type: application/json" on POST requests.401 Unauthorized
Missing X-API-Key header
Missing X-API-Key header
X-API-Key header, and no X-PAYMENT header was provided either.X-API-Key: lg_live_xxxxxxxxxxxxxxxxxxxx to every request. Free endpoints (health, key creation, well-known routes) never require authentication.Revoked or expired key
Revoked or expired key
POST /v1/keys/create. Keys are returned once — if lost, create a new one.Key prefix mismatch
Key prefix mismatch
lg_test_) is being used without the X-LimitGuard-Mode: sandbox header against a live endpoint, or vice versa.Fix: Use lg_live_ keys for production. lg_test_ keys automatically activate sandbox mode regardless of headers.402 Payment Required
HTTP 402 is a protocol response, not just an error. LimitGuard implements the x402 V2 micropayment protocol. When you receive a 402, the response body is not an RFC 7807 error — it is a payment requirements object.X-PAYMENT header.Payment Requirements Response
x402 Payment Flow
Check the amount
amount field uses 6 decimal places. 50000 = $0.05 USDC. Verify your wallet has sufficient balance before signing.Build EIP-3009 signature (EVM) or SPL transfer (Solana)
TransferWithAuthorization with a unique nonce and a validBefore 5 minutes in the future. See the x402 Protocol guide for full code examples.Common 402 Sub-Cases
Insufficient payment amount
Insufficient payment amount
amount in your payment object is less than the minimum required for the endpoint and quality tier.amount value from the 402 response exactly. If using a non-default X-Response-Quality tier, the required amount changes — cached requires less, enhanced requires more. See the pricing table for per-endpoint amounts.Expired payment signature (validBefore exceeded)
Expired payment signature (validBefore exceeded)
validBefore timestamp in the EIP-3009 signature has passed. Signatures are valid for 5 minutes.Fix: Rebuild the payment with a fresh timestamp. Do not cache signatures for reuse — build a new one per request.Nonce replay detected
Nonce replay detected
Invalid payment signature
Invalid payment signature
sender field matches the wallet that signed the transaction. Verify the EIP-712 domain parameters match exactly: name: "USD Coin", version: "2", chainId as integer, verifyingContract as the USDC contract address.Unsupported chain
Unsupported chain
chainId in your payment is not in the accepted list.Fix: Use one of the four supported chain IDs: eip155:8453 (Base Mainnet), eip155:84532 (Base Sepolia), solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp (Solana Mainnet), or solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1 (Solana Devnet).403 Forbidden
Endpoint not available on current tier
Endpoint not available on current tier
/v1/kyb/check and /v1/compliance/* are only available on pro and enterprise tiers.Sandbox key on live endpoint
Sandbox key on live endpoint
lg_test_ key is being used but the request is routed to live data sources.Fix: Use lg_live_ keys for production. Test keys are sandboxed — they only return mock data.Read-only key attempting write
Read-only key attempting write
404 Not Found
Entity not found
Entity not found
GET /v1/reputation/history/{entity_hash}) was called with an entity hash that does not exist in the system.POST /v1/entity/check first to create the entity record, then use the returned entity_hash for subsequent lookups.Webhook not found
Webhook not found
DELETE /v1/webhooks/{webhook_id} or test call was made with an unknown webhook_id.Fix: Use GET /v1/webhooks to list all registered webhooks and confirm the correct webhook_id.Unknown endpoint path
Unknown endpoint path
/v1/entity/checks instead of /v1/entity/check) or a missing version prefix.Fix: All API endpoints are under /v1/. Refer to the API Reference for the exact path of each endpoint.409 Conflict
Duplicate webhook URL
Duplicate webhook URL
GET /v1/webhooks to check existing registrations. If you want to update events for an existing webhook, delete it first and re-create with the new configuration.422 Unprocessable Entity
422 errors occur when the request is syntactically valid JSON but the field values fail business-logic validation. Thedetail field is always an array of field-level errors.
Common Validation Errors
Invalid country code
Invalid country code
country is not a valid ISO 3166-1 alpha-2 code, or uses the alpha-3 format.Fix: Use two-letter uppercase codes: NL, BE, DE, FR, US. Not NLD, Netherlands, or lowercase nl.entity_name too short or too long
entity_name too short or too long
entity_name is fewer than 2 characters or more than 255 characters.Fix: Pass the legal entity name as registered. Single-character values and very long strings are rejected.Invalid KVK number format
Invalid KVK number format
kvk_number contains non-numeric characters or is not exactly 8 digits.Fix: KVK numbers are always 8 digits: "12345678". Do not include spaces, dashes, or the KVK: prefix.Invalid IBAN format
Invalid IBAN format
iban fails structural validation (country prefix, check digits, or length for the given country).Fix: Pass a complete IBAN including country code and check digits: "NL91ABNA0417164300". Strip spaces before sending.Invalid VAT number format
Invalid VAT number format
vat_number does not match the expected format for the given country prefix.Fix: Include the country prefix: "NL123456789B01", "BE0123456789". Format rules vary by country — see the European Commission VIES guidelines for country-specific formats.Invalid wallet address
Invalid wallet address
wallet_address is not a valid EVM (0x…, 42 chars) or Solana (base58, 32-44 chars) address.Fix: Validate the address client-side before sending. EVM addresses must be checksummed or all-lowercase hex. Solana addresses must be valid base58.Invalid domain format
Invalid domain format
domain contains a protocol prefix, path, or query string instead of a bare hostname.Fix: Send the bare domain only: "acmecorp.nl" — not "https://acmecorp.nl/about?lang=en".Invalid webhook event type
Invalid webhook event type
events array in POST /v1/webhooks contains an unrecognized event name.Fix: Use events from the supported list: trust_score.updated, compliance.alert, entity.flagged, risk.threshold_exceeded. Check GET /v1/webhooks for the current supported list.429 Too Many Requests
LimitGuard enforces two independent limits: a per-minute rate limit and a monthly quota.Rate Limit Response
Retry-After Header
Every 429 response includes aRetry-After header with the number of seconds to wait:
| Header | Description |
|---|---|
Retry-After | Seconds until the rate limit window resets |
X-RateLimit-Limit | Maximum requests allowed per minute for your tier |
X-RateLimit-Remaining | Requests remaining in the current window |
X-RateLimit-Reset | Unix timestamp when the window resets |
Rate Limits by Tier
| Tier | Requests/min | Monthly Quota |
|---|---|---|
| Free | 10 | 500 |
| Starter | 60 | 5,000 |
| Pro | 300 | 50,000 |
| Enterprise | Custom | Custom |
| x402 (no key) | 30 | Unlimited (pay-per-use) |
Monthly Quota Exceeded
When your monthly quota is exhausted, thedetail changes:
500 Internal Server Error
- Note the
Request IDfrom thedetailfield. - Retry with exponential backoff — most 500s are transient.
- If the error persists for more than 5 minutes, check api.limitguard.ai/health for service status.
- Report persistent 500s to support@limitguard.ai with the Request ID.
503 Service Unavailable
- Check
Retry-Afterheader if present. - Subscribe to status updates at api.limitguard.ai/health.
- For x402 users: the circuit breaker fallback (cached wallet verification) handles most dependency failures transparently. A 503 indicates a more severe outage.
Error Handling Patterns
Recommended Client Logic
x402 Auto-Payment Handler
For AI agents that need to handle 402 responses automatically:Debugging Checklist
Getting 401 even with a valid key?
Getting 401 even with a valid key?
- Confirm the header name is exactly
X-API-Key(capital X, capital A, capital K) - Confirm the key value starts with
lg_live_orlg_test_ - Check for leading/trailing whitespace in the header value
- Verify the key has not been revoked — create a new one at
POST /v1/keys/create
Getting 422 but my JSON looks correct?
Getting 422 but my JSON looks correct?
- Check that
countryis exactly 2 uppercase characters:"NL"not"nl"or"Netherlands" - Check that
entity_nameis at least 2 characters - For
kvk_number: digits only, exactly 8 characters, as a string:"12345678"not12345678 - For
iban: strip all spaces before sending - The
detailarray in the response will list every failing field — read all of them before retrying
Getting 403 but my key is valid?
Getting 403 but my key is valid?
- Run
GET /v1/usage/summarywith your key to see your current tier - Check the pricing page for which endpoints are available on your tier
/v1/kyb/check,/v1/compliance/*, and enhanced quality tier requireproor higher
x402 payment keeps returning 402?
x402 payment keeps returning 402?
- Confirm
validBeforeis at least 60 seconds in the future (usenow + 300) - Confirm
chainIdin the payment payload exactly matches the one from the 402 response - Confirm
recipientmatches — do not substitute your own address - Confirm
amountmatches or exceeds the required amount - Generate a new random nonce for every attempt — do not reuse
- Confirm the USDC contract address matches the network (Base Mainnet vs Sepolia differ)
Intermittent 500 errors on entity checks?
Intermittent 500 errors on entity checks?
- 500 on entity checks is usually a transient timeout in a data source (e.g., KVK API slow response)
- Retry up to 3 times with exponential backoff: 1s, 2s, 4s
- If the error persists, try
X-Response-Quality: cachedto bypass live source queries - Include the
Request IDfrom the error body when contacting support
Free Endpoints (Never Error on Auth)
These endpoints always return 200 and never require authentication or payment. They will not return 401, 402, or 403:| Endpoint | Purpose |
|---|---|
GET /health | API health and version |
POST /v1/keys/create | Self-service key provisioning |
GET /.well-known/x402.json | x402 payment discovery |
GET /.well-known/agent.json | A2A agent card |
GET /.well-known/mcp.json | MCP manifest |
GET /v1/self-verify | LimitGuard’s own trust score |
GET /v1/methodology | Scoring methodology |
GET /v1/badge/{entity_id} | SVG trust badge |
GET /llms.txt | LLM-readable API summary |